cwsa workshop swan: survivable wireless ad hoc networks cristina nita-rotaru purdue university j...

CWSA Workshop

SWAN: Survivable Wireless Ad Hoc Networks

Cristina Nita-RotaruPurdue University

Joint work with: Baruch Awerbuch, Reza Curtmola, Dave Holmer and Herb Rubens

Johns Hopkins University

Cristina Nita-Rotaru CWSA Workshop 2

Wireless Revolution

WiFi ad hoc networks: infrastructure-less, distributed routing, maintenance built within the network, quick and cost-effective deployment.

Cellular networks: 3G cellular networks promise us multimedia contents (already provided in Japan by DoCoMo and in Europe by Vodafone).

Mesh networks: structured (mesh) wireless networks, providing the ‘last mile’ in terms of bandwidth. (cities like NYC and Phily; companies:Tropos, Flarion, Motorola, MeshNetworks, etc.)


Why You Need to Care About Security

QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.

Access control: medium is shared, lack of access control can translate into degradation of service.

Confidentiality: medium is open, vulnerable to eavesdropping.

Trust: multi-hop networks, nodes rely on un-trusted nodes to transport data.

Physical security: wireless devices are more likely to be stolen, data get compromised or an attacker can attack the network from the “inside”.

Physical layer: easy to jam.


Survivability Concepts

Fault-tolerance: benign failures (network partitions and merges, process crashes).

Confidentiality: protects from eavesdropping. Active attacks: impersonation, replay attacks. Denial of service: resource consumption. Internal attacks: part of the infrastructure is compromised.

Survivable protocols are able to provide correct service in the presence of attacks and failures.

Byzantine adversary: an adversary that can do anything


Focus of This Talk

Goal: designing routing protocols for multi-hop wireless networks that can provide correct service in the presence of compromised participants, as long as a correct (non-adversarial) path exists between source and destination.

Challenges: mobility, decentralized environment, prone to errors, difficult to distinguish between failures and malicious behavior.


Outline

Attacks against routing in ad hoc wireless networks

ODSBR• Goals and approach• Protocol description• Simulations showing attack

mitigation Current and future work


Routing in Ad Hoc Wireless Networks On-demand protocols

• Discover a path only when a route is needed • Flood to find a path to the destination, then use the reverse path

to inform the source about the path• Use duplicate suppression technique, only first flood that

reaches a node is processed, next are discarded (all have the same identifier, higher identifiers denote new requests)

• Shortest path is selected based on a metric: AODV uses a hop count, while DSR uses the shortest recorded path

• Nodes cache discovered routes• Route maintenance mechanisms, nodes report broken links


Fabrication and Modification Attacks Change the path on the request packet and forward it Generate false request messages to burden the network Spoof IP address and send request Send false route replies, modify replies, false topology Send higher sequence numbers Result: Nodes can add to a path and make it less probable that

the “shortest path” is through them, or can shorten paths to make it more likely they are on paths. Use this to either avoid forwarding traffic, or for traffic analysis.

Attacks against routing

Attack is possible because of lack on integrity and authentication of the packets and no control of malicious behavior.


Fabrication and Modification Attacks (cont.)

Generate false route error messages Drop route error messages Spoof IP address and send error message for a valid

route Result: Attacker can continually tear down routes with

false error messages, or by not reporting the error, packets will be lost.


Attack is possible because of lack on integrity and authentication of the packets.


Wormhole Attack

The wormhole turns many adversarial hops into one virtual hop creating shortcuts in the network

Attacker (or colluding attackers) records a packet at one location in the network, tunnels the packet to another location, and replays it there.

PACKETS LOOK LEGITIMATE, authentication and freshness mechanisms not enough.

Result: Allows an adversary to control path selection.


QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.

Attack is possible because of lack of a mechanism that controls that packets traveled on shortcuts.


Flood Rushing Attacks

Attacker disseminates request quickly throughout the network suppressing any later legitimate request• By avoiding the delays that are part of the design of both

routing and MAC (802.11b) protocols• By sending at a higher wireless transmission level• By using a wormhole to rush the packets ahead of the normal

flow Result: no path is established, or an attacker gets selected on

many paths


Attack is possible because of flood request suppressing technique and attacker can rush packets through the network.


Misbehaving Nodes Ad hoc networks maximize

total network throughput by using all available nodes for routing and forwarding.

A node may misbehave by agreeing to forward the packet and then failing to do so because it is selfish, malicious (black holes) or fails (errors).

Result: throughput drops


QuickTime™ and aTIFF (Uncompressed) decompressorare needed to see this picture.

Challenge: distinguish between the above 3 types of behavior.


ODSBR: Design Principles

Hop-by-hop protection, intermediate nodes are authenticated but not trusted

Instead of preventing wormholes formation, detect them if they cause problems

Limit the amount of damage an attacker can create to the network

Do not partition the network Use a link reliability metric in which suspect links are avoided

regardless of actual reason for detection• Malicious behavior• Adverse network behavior (bursting traffic)• Shelfish or failures


ODSBR Overview

Route Discoverywith Fault Avoidance

Link WeightManagement

Byzantine FaultDetectionDiscovered Path

Faulty LinksWeight List

An On-Demand Secure Routing Protocol Resilient to Byzantine Failures. In ACM Workshop on Wireless Security (WiSe), In conjunction with MOBICOM 2002, Baruch Awerbuch, Dave Holmer, Cristina Nita-Rotaru, and Herbert Rubens.


Fault Detection Strategy Use authenticated acknowledgements from

nodes on the path (requires source routing) Probing technique: ask every node to send

acknowledgements

S D

ODSBR Description


Trusted End Point

Intermediate Router

Adaptive ProbingSource Destination

Success

Fault 1

Fault 2

Fault 3

Fault 4

Successful Probe

Failed Probe

Fault Location

Successful Interval

Failed Interval

Unknown Interval


Blackhole and Flood Rush

20

30

40

50

60

70

80

90

100

0 2 4 6 8 10

Number of Adversaries

Delivery Ratio (%)

AODV 0 m/s 1 m/s 5 m/s 10 m/sODSBR 0 m/s 1 m/s 5 m/s 10 m/s

Simulations

Flood rushing helps the attacker to get selected on more paths, thus he can create more damage.


Wormhole Central Configuration

20

30

40

50

60

70

80

90

100

0 1 2 3 4 5 6 7 8 9 10

Speed (m/s)

Delivery Ratio (%)

AODV-normal AODV-worm AODV-worm-rushODSBR-normal ODSBR-worm ODSBR-worm-rush

Simulations

(700,500)(300,500)

(a) Central Wormhole

ODSBR not affected by flood rushing, while one wormhole centrally placed creates significant damage.


Wormhole Overlay: Complete Coverage

20

30

40

50

60

70

80

90

100

0 1 2 3 4 5 6 7 8 9 10

Speed (m/s)

Delivery Ratio (%)

AODV-normal AODV-worm AODV-worm-rushODSBR-normal ODSBR-worm ODSBR-worm-rush

(500,500)

(750,750)(250,750)

(250,250) (750,250)

(c) Complete Coverage

Simulations

Delivery ratio of AODV drops to 20%. 5 Adversaries completely control a network of 50 nodes.


ODSBR: Summary

Most important factors for of effective attack: flood rushing and strategic positioning of adversaries.

Two colluding adversaries forming a central wormhole combined with flood rushing can mount an attack that has the highest relative strength, it reduced AODV's delivery ratio to 51%.

ODSBR was able to mitigate a wide range of Byzantine attacks; not significantly affected by flood rushing. Its performance only decreased when it needed to detect and avoid a large number of adversarial links.


Ongoing and Future Work

Extend the model to hybrid networks (see our poster tomorrow!!!)

Investigate denial of service attacks against MAC(see our poster tomorrow!!!).

High-throughput aware routing, focus on interference from other flows.

Apply similar techniques to mesh networks, while taking advantage of their static nature.

http://www.cerias.purdue.edu/homes/crisn/lab/swan.html

cwsa workshop swan: survivable wireless ad hoc networks cristina nita-rotaru purdue university j...

Documents